An SAP breach can reach far beyond one server. Depending on the deployment, the same platform may handle financial records, orders, identity, and connections to other business systems. Four maximum-severity flaws in SAP’s November 10 patch cycle therefore demand a clear inventory decision: which running systems contain the affected components, and which of those components can an attacker reach? The release spans the Internet Communication Manager, Web Dispatcher, Gateway, and the ABAP SAML2 service provider. Each issue carries a CVSS 3.1 score of 10.0. The published severity describes potential impact; it does not establish that any of the flaws is being exploited.

TL;DR

  • SAP published four CVSS 10.0 issues in its November 2026 Security Patch Day, alongside other security notes and GitHub advisories.
  • Prioritize reachable Web Dispatcher and Internet Communication Manager instances, Gateway access paths, and ABAP systems using the affected SAML2 service provider.
  • Match each system’s installed component and patch level to the relevant SAP Security Note. A completed change ticket is not evidence that the corrected version is running.
  • SAP’s public patch-day listing does not report active exploitation of these four flaws. Do not present their maximum score as proof of an ongoing attack.

Why these four matter

The vulnerable components sit on different trust boundaries. Web Dispatcher and the Internet Communication Manager process network traffic. Gateway decides how application servers and external systems communicate. The SAML2 service provider validates authentication assertions. An attacker who crosses one of those boundaries could potentially reach business data or privileged functions. If a compromised SAP system is connected to other applications, the operational consequences could include unauthorized transactions, altered records, or disrupted workflows. Those outcomes are plausible risks, not incidents reported in SAP’s advisory; their scope depends on the organization’s topology, permissions, and integrations.

SAP lists 35 new security notes and four GitHub security advisories for November 10, plus three updates to earlier notes. The four highest-scored entries are:

CVEAffected componentSAP Security NotePublished issue
CVE-2026-76964NetWeaver AS ABAP Internet Communication Manager3778530Memory corruption
CVE-2026-89126SAP Web Dispatcher3778556Memory corruption
CVE-2026-89103SAP Gateway3798345Broken access control
CVE-2026-120017NetWeaver AS ABAP and ABAP Platform SAML2 service provider3849308Missing authentication

The SAP patch-day listing identifies affected product and component versions for each note. Its version list is a starting point, not a substitute for the note’s correction instructions and prerequisites in SAP’s support portal.

Technical analysis: four different paths across a trust boundary

The two memory-corruption issues affect separate network-facing components. SAP describes CVE-2026-76964 in the Internet Communication Manager and CVE-2026-89126 in Web Dispatcher. The public descriptions identify the affected components and impact, but do not provide a packet pattern or a reliable exploit-specific detection signature. Treat unexplained crashes or restarts as investigative leads, not proof of exploitation.

For CVE-2026-89103, SAP’s vulnerability record says the Gateway’s default access-control list can assign high trust to an external party, treating it as an internal application server. An unauthenticated attacker with network access to the Gateway could then perform unauthorized actions. This makes network reachability and the effective Gateway access rules central to triage. A perimeter scan alone cannot establish the effective trust decision inside the Gateway.

For CVE-2026-120017, SAP says that, under certain configurations, the ABAP SAML2 service provider insufficiently verifies incoming authentication assertions. A crafted assertion could let an unauthenticated attacker impersonate a user, including a privileged one. Confirm whether SAML2 is enabled and how the affected service provider is exposed before assigning priority. Do not assume every ABAP installation has the same exposure.

These are vendor-described effects, not observed attack chains. SAP’s public listing does not identify a specific exploit attempt or campaign for the four issues. An organization with its own suspicious activity should investigate it separately using its SAP, identity-provider, reverse-proxy, and network logs.

What You Can Do Today

  1. Find affected instances. Inventory Web Dispatcher, Internet Communication Manager, Gateway, and ABAP SAML2 service-provider deployments. Record the product, component version, installed patch level, system owner, and internet or internal network reachability. Include development and integration systems that can reach production.
  2. Map each instance to the SAP note. Use Notes 3778530, 3778556, 3798345, and 3849308 to identify the applicable correction and prerequisites. Do not infer a universal fixed version from the CVSS score or another product’s patch level.
  3. Prioritize the reachable trust boundaries. Put exposed Web Dispatcher and Internet Communication Manager endpoints, reachable Gateways, and SAML2 login paths first. While changes are scheduled, restrict unnecessary network access to those services using the organization’s existing controls; that reduces exposure but does not replace the vendor correction.
  4. Apply and verify. Follow SAP’s note-specific installation instructions. After the required restart or deployment step, confirm the running component’s patch level and recheck the relevant access or authentication path. Record systems that cannot be patched yet and the access restriction applied to each.
  5. Review evidence where warranted. For systems with suspicious activity, preserve relevant SAP, identity, proxy, and network logs before retention periods expire. Investigate unusual Gateway connections, SAML2 sign-ins inconsistent with identity-provider records, and unexpected service restarts in context. None of these signs alone identifies exploitation of a specific CVE.

Sources